Remote
Syslog with MySQL and PHP[3] - Msyslog has the ability to log syslog messages
to a database. This allows for easier monitoring of multiple servers and the
ability to be display and search for syslog messages using PHP or any other
programming language that can communicate with the database.by that, too.

Review:
Mastering Network Security, Second Edition[4] - The introduction states
that this book is aimed at systems administrators who are not security experts,
but have some responsibility for ensuring the integrity of their systems.
That would seem to cover most sysadmins.

A
vulnerability has been discovered in NANOG traceroute, an enhanced version
of the Van Jacobson/BSD traceroute program. A buffer overflow occurs
in the 'get_origin()' function. Due to insufficient bounds checking
performed by the whois parser, it may be possible to corrupt memory on
the system stack. This vulnerability can be exploited by a remote
attacker to gain root privileges on a target host. Though, most probably
not in Debian.

Andrew
Griffiths and iDEFENSE Labs discovered a problem in tcpdump, a powerful
tool for network monitoring and data acquisition. An attacker is
able to send a specially crafted network packet which causes tcpdump to
enter an infinite loop.

This
is a full update of the KDE desktop to the 3.0.5a version, the latest 3.0.x
release from the KDE project[1]. Besides containing several bugfixes and
enhancements, this update also fixes several security
vulnerabilities[2] found during an internal code audit organized by the
KDE team.

Vulnerable[2][3]
openssl versions do not perform a MAC computation if an incorrect block
cipher padding is used. An active attacker who can insert data into an
existing encrypted connection is then able to measure time differences
between the error messages the server sends. This information can make
it easier to launch cryptographic attacks that rely on distinguishing between
padding and MAC verification errors, possibly leading to extraction of
the original plaintext.

Keigo
Yamazaki discovered a vulnerability in miniserv.pl (the webserver program
at the core of the WebTool) which may allow an attacker to spoof a session
ID by including special metacharacters in the BASE64 encoded string using
during the authentication process. This may allow a remote attacker to
gain full administrative privileges over the WebTool. All users are
recommended to upgrade immediately.

Once
a syncookie key has been recovered, an attacker may construct valid ISNs
until the key is rotated (typically up to four seconds). The ability to
construct a valid ISN may be used to spoof a TCP connection in exactly
the same way as in the well-known ISN prediction attacks (see `References').
Spoofing may allow an attacker to bypass IP-based access control lists
such as those implemented by tcp_wrappers and many firewalls. Similarly,
SMTP and other connections may be forged, increasing the difficulty of
tracing abusers. Recovery of a syncookie key will also allow the
attacker to reset TCP connections initiated within the same 31.25ms window.

The
VNC server acts as an X server, but the script for starting it generates
an MIT X cookie (which is used for X authentication) without using a strong
enough random number generator. This could allow an attacker to be
able to more easily guess the authentication cookie.

The
VNC server acts as an X server, but the script for starting it generates
an MIT X cookie (which is used for X authentication) without using a strong
enough random number generator. This could allow an attacker to be
able to more easily guess the authentication cookie.

One
feature that most terminal emulators support is the ability for the shell
to set the title of the window using an escape sequence. Certain
xterm variants also provide an escape sequence for reporting the current
window title. This essentially takes the current title and places
it directly on the command line. This feature could be potentially
exploited if an attacker can cause carefully crafted escape sequences to
be displayed on a vulnerable terminal emulator used by their victim.

During
an internal source code review done by Thomas Biege several bugs where
found in hypermail and its tools. These bugs allow remote code execution,
local tmp race conditions, denial-of-service conditions and read access
to files belonging to the host hypermail is running on. Additionally
the mail CGI program can be abused by spammers as email-relay and should
thus be disabled.

A
vulnerability was discovered in the Kerberos FTP client. When the
client retrieves a file that has a filename beginning with a pipe character,
the FTP client will pass that filename to the command shell in a system()
call. This could allow a malicious remote FTP server to write to
files outside of the current directory or even execute arbitrary commands
as the user using the FTP client.

A
vulnerability was discovered in lynx, a text-mode web browser. The
HTTP queries that lynx constructs are from arguments on the command line
or the $WWW_HOME environment variable, but lynx does not properly sanitize
special characters such as carriage returns or linefeeds. Extra headers
can be inserted into the request because of this, which can cause scripts
that use lynx to fetch data from the wrong site from servers that use virtual
hosting.

The
shadow-utils package contains the tool useradd, which is used to create
or update new user information. When useradd creates an account,
it would create it with improper permissions; instead of having it owned
by the group mail, it would be owned by the user's primary group.
If this is a shared group (ie. "users"), then all members
of the shared group would be able to obtain access to the mail spools of
other members of the same group. A patch to useradd has been applied
to correct this problem.